在互联世界中保护物联网

Securing Cellular IoT: What Every Executive Needs to Know This is a whitepaper of the GSMA IoT Community September 2025 This briefing provides business executives with a high-level overview of how toenhance security and robustness in cellular IoT deployments. Drawing on GSMA’s IoT Security Guidelines (FS.60), it classifies security threats, mitigation strategies, andbest practices by relevance and importance across three key domains: Devices, Mobile Networks, andApplications. Overview of Accountabilityper industry role Device-RelatedSecurity High-Priority Threats and Mitigations Risk: Compromiseddevices can leak dataor be hijacked (e.g.,for botnets). Mitigations:Strongauthentication, secureprovisioning, encryptedcredentials, and identitylifecycle management. Best Practices Carry out regularfirmware updates withrollback protection. Implement securedecommissioningprocesses. Risk:Malicious codecan lead to persistentcompromise or lateralmovement. Mitigations:Secureboot, firmware signing,runtime integrity checks,secure update delivery. Malware Infections/Code Injection Use hardware securitymodules (HSMs),tamper-resistantelements (e.g. eSIMs/iSIMs, secure elements)for cryptographicfunctions (and notSoftSIM). Risk:Physicalaccess can exposecredentials or allowhardware attacks. Mitigations:Tamper-evident design, use oftamper-resistant, hardwaresecure elements (e.g., eSIMs),secure storage for keys. Mobile Network-RelatedSecurity High-Priority Threats and Mitigations Mitigations:Mutualauthentication usingSIM/eSIM, network certificatevalidation. Risk:Enablesman-in-the-middle(MitM) attacks and fakebase stations. Best Practices Continuously monitornetwork. Spoofing/Impersonat-ion of Network Entities Mitigations:3GPP-standard encryption,TLS/DTLS protocols, VPNtunnelling for sensitive traffic. Risk:Unencryptedtransmissions canexpose confidential orsensitive data. Data Interception/Eavesdropping Use operator-gradefirewalls and intrusionprevention systems. Mitigations:Ratelimiting, network trafficprofiling, anomaly detectionsystems. Risk:Can degradeor block deviceconnectivity. Signaling Attacks(e.g., Denial of Service) Application-RelatedSecurity High-Priority Threats and Mitigations Mitigations:Strongauthentication, inputvalidation, access control,rate limiting. Risk:Common pointof exploitation fordata exfiltration or servicemanipulation. Best Practices Penetration testing andregular vulnerabilityassessments. Mitigations:End-to-endencryption, securedata storage, logging andmonitoring. Risk:Highregulatory andreputational impact. Data Breaches Incident responseplanning and data breachnotification protocols. Mitigations:Role-basedaccess control (RBAC),least privilege, Multi-FactorAuthentication (MFA). Risk:Leads tounauthorized accessto critical systems. Security ManagementKey Recommendations Adopt a Holistic Security Model:Integrate security across devices,networks, and application layers. Invest in Lifecycle Security:Includesecure design, deployment, maintenance,and decommissioning. Prioritise by Risk and Business Impact:Focus first on high-impact,high-likelihood threats. Partner with Trusted Ecosystem Players:Ensure your vendors, operators, andintegrators follow GSMA and industrybest practices. Stay Informed:Monitor threatintelligence feeds and participate inIoT security working groups. Further Reading:Full GSMA IoT Security Guidelines (FS.60):https://www.gsma.com/solutions-and-impact/technologies/internet-of-things/wp-content/uploads/2024/07/FS.60.pdf GSMA Head Office1 Angel LaneLondonEC4R 3ABUKEmail: info@gsma.com